{"record":{"id":"0eeb0caec5ca6627","repo":"hashicorp/packer","slug":"write-sigstore-bundle-q-w","errorCode":null,"errorMessage":"write Sigstore bundle %q: %w","messagePattern":"write Sigstore bundle %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":342,"sourceCode":"\t\tenvelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)\n\t}\n\n\tif err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {\n\t\treturn fmt.Errorf(\"verify signed attestation: %w\", err)\n\t}\n\n\toutput, err := json.MarshalIndent(envelope, \"\", \"  \")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal signed envelope: %w\", err)\n\t}\n\n\tif err := atomicWriteFile(outputPath, output, 0664); err != nil {\n\t\treturn fmt.Errorf(\"write attestation %q: %w\", outputPath, err)\n\t}\n\n\tif len(bundleJSON) > 0 {\n\t\tif err := atomicWriteFile(bundlePath, bundleJSON, 0664); err != nil {\n\t\t\treturn fmt.Errorf(\"write Sigstore bundle %q: %w\", bundlePath, err)\n\t\t}\n\t\tui.Say(fmt.Sprintf(\"Wrote Sigstore bundle to %s\", bundlePath))\n\t}\n\n\tui.Say(fmt.Sprintf(\"Wrote attestation to %s\", outputPath))\n\treturn nil\n}\n\nfunc (p *PostProcessor) signingResources(ctx context.Context, backendConfig internalattestation.BackendConfig) (internalattestation.Signer, internalattestation.Verifier, error) {\n\tif p.signingResourcesFn != nil {\n\t\treturn p.signingResourcesFn(ctx, backendConfig)\n\t}\n\n\tif backendConfig.Mode == internalattestation.SigningModeNone {\n\t\treturn nil, nil, nil\n\t}\n\n\tsigner, err := internalattestation.NewSigner(ctx, backendConfig)","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L324-L360","documentation":"Wraps a failure from atomicWriteFile when persisting the generated Sigstore bundle next to the attestation file. The bundle path could not be written (bad directory, permissions, disk full). The underlying OS error is preserved via %w.","triggerScenarios":"writeAttestation (called from PostProcess or writeSBOMAttestation) runs when len(bundleJSON) > 0 and atomicWriteFile(bundlePath, bundleJSON, 0664) returns a non-nil error.","commonSituations":"output_path directory does not exist or is not writable; disk quota exceeded; bundlePath points at a read-only mount or a directory instead of a file; permission denied under a restrictive umask or non-root CI user.","solutions":["Ensure the directory containing the bundle path exists before running packer (mkdir -p).","Check filesystem permissions/write access for the user running packer (file mode is 0664).","Free disk space or fix quota limits.","Verify the bundle path derived from your output_path config is a writable file path, not a directory.","If on a read-only volume, redirect output_path to a writable location."],"exampleFix":"// before\n\"output_path\": \"/proc/attestation.json\"\n// after\n\"output_path\": \"./out/attestation.json\"","handlingStrategy":"validation","validationCode":"import os\nfunc ensureWritableDir(path string) error {\n\tdir := filepath.Dir(path)\n\tif st, err := os.Stat(dir); err != nil {\n\t\treturn fmt.Errorf(\"dir %s missing: %w\", dir, err)\n\t} else if !st.IsDir() {\n\t\treturn fmt.Errorf(\"%s is not a directory\", dir)\n\t}\n\tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0664)\n\tif err != nil { return err }\n\treturn f.Close()\n}\n// call ensureWritableDir(bundlePath) before configuring output_path","typeGuard":null,"tryCatchPattern":"if err := p.PostProcess(ctx, ...); err != nil {\n\tvar pe *os.PathError\n\tif errors.As(err, &pe) {\n\t\tlog.Printf(\"bundle write failed at %s: %v\", pe.Path, pe.Err)\n\t}\n\treturn err\n}","preventionTips":["Pre-create output directories in CI before running packer.","Run packer as a user with write access to output_path.","Validate output_path with packer validate / a dry run first.","Watch disk space on the output volume."],"tags":["filesystem","io","sigstore"],"backgroundTag":"file-write-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}